I have two machines that run Devuan.  One runs stable, the other oldstable.

The oldstable machine was running the current openvpn for oldstable 2.4.7 (off the top of my head).  So the VPN company I use decided to do a security overhaul and presumably upgraded all there infrastructure to a newer version.  So at some point, that machine stopped connecting because the version was too old.  I tried exploring backports, and also explored pulling in OpenVPN from stable, to no avail. I found I could get it to connect by commenting out data-ciphers in the ovpn file, but that's not an ideal solution.

My solution was to build the newest from source.  I grabbed all the dependencies from the Devuan repos.  I will take over maintaining OpenVPN myself as I would prefer it was up to date (latest version of OpenVPN, ie, 2.6.4 currently).

So my question.

Are there any security implications, besides the obvious need to rebuild when the dependencies get updated?

I do come from a Slackware background and the need to monitor lists and manually upgrade things is not a big problem for me.  I did it for years when i ran Slackware.